Common Weakness Enumeration
CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
17316 vulnerabilities reference this CWE, most recent first.
CVE-2026-103239 (GCVE-0-2026-103239)
Vulnerability from cvelistv5 – Published: 2026-09-30 10:16 – Updated: 2026-09-30 16:50
VLAI
EPSS
VEX
Title
MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection
Summary
MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload.
A user holding the tag editor permission could craft a request that includes additional model data (such as User or Organisation records) alongside the tag collection fields. Because the save operation processed all associated models indiscriminately, the injected sibling records were written to the database, enabling the attacker to modify or create privileged accounts and escalate to site administrator.
Preconditions:
- An authenticated account with the tag editor permission (perm_tag_editor)
- Network access to the MISP instance
Impact:
- Unauthorized creation or modification of User and Organisation records
- Privilege escalation from tag editor to site administrator
Affected versions: < 2.5.48
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 16:49 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/MISP/MISP/commit/96f735e7b | patch |
Impacted products
GCVE extensions
AI-generated
Human-reviewed
Confidence: high
Model
qwen3.8:27b
advisory
bcp-05-x-01bcp-05-x-02
AI involvement
GCVE-BCP-05-X-01
Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.
ai-computer-assisted:llm-generatedai-computer-assisted:classification
| Model | Source | Identifier |
|---|---|---|
| qwen3.8:27b | ollama | qwen3.8:27b |
Patch provenance
GCVE-BCP-05-X-02
- Generator
-
patch2vuln.pyon 2026-09-30 09:58 - Model
qwen3.8:27b- Input
-
https://github.com/MISP/MISP/commit/96f735e7b.patch
67f9b5741b88… - Confidence
- high
| Commit | Subject | Patch SHA-256 |
|---|---|---|
96f735e7b5d9
|
fix: [security] Tag collection saves no longer write sibling | 67f9b5741b88… |
Fix summary
The fix replaces the bulk-association save call with an explicit two-step process: first, only the TagCollection data is extracted from the request and saved via a plain save() operation that does not write belongsTo siblings; second, tag association rows are persisted individually in a controlled loop. This ensures that any User, Organisation, or other sibling model data present in the request payload is silently discarded and never reaches the database, eliminating the privilege escalation path.
Patch summary
In TagCollectionsController.php, both addWithTags() and editWithTags() were modified. The full $this->request->data is no longer passed to saveAssociated(). Instead, only the TagCollection key is extracted from the request. The saveAssociated() call is replaced with a plain save() for the collection, followed by an explicit loop that creates and saves each TagCollectionTag row individually. In editWithTags(), the tag rewrite logic is restructured to delete existing tag associations and re-insert them after the collection save. REST success/failure response handling is added to both methods.
CVSS rationale
The vulnerability is exploitable over the network (AV:N) with low complexity (AC:L) by simply adding extra fields to a legitimate tag collection request. No special attack conditions are required (AT:N). The attacker needs an authenticated account with the tag editor permission (PR:L). No user interaction is needed (UI:N). The primary impact is on integrity (VI:H) because the attacker can create or modify User and Organisation records to escalate to site admin. Modifications can be made so data can be see (VC:H) but no availability impact (VA:N). No subsequent component is affected (SC:N, SI:N, SA:N).
Weakness rationale
- CWE-284 A user with only tag editor permissions was able to write to User and Organisation records through the bulk-association save, bypassing the intended access control boundaries. The authorization model did not restrict which associated models could be persisted.
- CWE-862 The saveAssociated() call did not enforce per-model authorization checks, allowing any associated model data in the payload to be written regardless of the caller's permissions for those models.
Attack pattern rationale
- CAPEC-126 The attacker tampers with the HTTP request by injecting additional model fields (User, Organisation) into the tag collection payload. The application's bulk-save logic processes these unexpected parameters without filtering, leading to unauthorized record creation or modification. This is the closest CAPEC to the observed attack: adding extra parameters to a legitimate request to trigger unintended side effects.
- CAPEC-1 The application accepted the entire request body without validating or restricting which model keys were present before passing it to the persistence layer. This is a secondary mapping; CAPEC-126 is more specific to the parameter-injection attack vector observed here.
Assumptions to verify
- The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 24 commits after fix), suggesting the fix is included in v2.5.48. No explicit version range is stated in the patch itself.
- The privilege level required is assumed to be 'perm_tag_editor' based on the commit message; the exact permission model and whether other roles are affected is not fully verifiable from the patch alone.
- CAPEC-126 (Parameter Tampering) is selected as the closest match; the attack is more precisely a mass-assignment / sibling-model injection via an ORM bulk-save, for which no exact CAPEC exists. CAPEC-126 is the best available approximation.
- The CVSS assumes the attacker can reach the MISP web interface over the network and holds a valid session with tag editor permissions. No multi-step or race-condition requirements are evident.
- The Co-Authored-By line references an AI assistant (Claude Opus 4.8); it is credited as a tool rather than a human remediation developer.
Model comparison
Selected qwen3.8:27b
by deterministic-consensus-v1
The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required.
| Model | Score | Agreement | Confidence | Assumptions |
|---|---|---|---|---|
qwen3.8:27b |
6 | 9 | high | 5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-103239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T16:49:52.252773Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T16:50:57.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:misp:misp:*:*:*:*:*:*:*:*"
],
"modules": [
"TagCollectionsController"
],
"product": "MISP",
"programFiles": [
"app/Controller/TagCollectionsController.php"
],
"repo": "https://github.com/MISP/MISP",
"vendor": "MISP",
"versions": [
{
"lessThan": "2.5.48",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload.\u003c/p\u003e\u003cp\u003eA user holding the tag editor permission could craft a request that includes additional model data (such as User or Organisation records) alongside the tag collection fields. Because the save operation processed all associated models indiscriminately, the injected sibling records were written to the database, enabling the attacker to modify or create privileged accounts and escalate to site administrator.\u003c/p\u003e\u003cp\u003ePreconditions:\u003c/p\u003e\u003cp\u003e- An authenticated account with the tag editor permission (perm_tag_editor)\u003c/p\u003e\u003cp\u003e- Network access to the MISP instance\u003c/p\u003e\u003cp\u003eImpact:\u003c/p\u003e\u003cp\u003e- Unauthorized creation or modification of User and Organisation records\u003c/p\u003e\u003cp\u003e- Privilege escalation from tag editor to site administrator\u003c/p\u003e\u003cp\u003eAffected versions: \u0026lt; 2.5.48\u003c/p\u003e"
}
],
"value": "MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag collection record but also any associated model data present in the payload.\n\nA user holding the tag editor permission could craft a request that includes additional model data (such as User or Organisation records) alongside the tag collection fields. Because the save operation processed all associated models indiscriminately, the injected sibling records were written to the database, enabling the attacker to modify or create privileged accounts and escalate to site administrator.\n\nPreconditions:\n\n- An authenticated account with the tag editor permission (perm_tag_editor)\n\n- Network access to the MISP instance\n\nImpact:\n\n- Unauthorized creation or modification of User and Organisation records\n\n- Privilege escalation from tag editor to site administrator\n\nAffected versions: \u003c 2.5.48"
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Parameter Tampering"
}
]
},
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Improper Input Validation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T10:16:18.835Z",
"orgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"shortName": "CIRCL"
},
"references": [
{
"name": "Security patch",
"tags": [
"patch"
],
"url": "https://github.com/MISP/MISP/commit/96f735e7b"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe fix replaces the bulk-association save call with an explicit two-step process: first, only the TagCollection data is extracted from the request and saved via a plain save() operation that does not write belongsTo siblings; second, tag association rows are persisted individually in a controlled loop. This ensures that any User, Organisation, or other sibling model data present in the request payload is silently discarded and never reaches the database, eliminating the privilege escalation path.\u003c/p\u003e"
}
],
"value": "The fix replaces the bulk-association save call with an explicit two-step process: first, only the TagCollection data is extracted from the request and saved via a plain save() operation that does not write belongsTo siblings; second, tag association rows are persisted individually in a controlled loop. This ensures that any User, Organisation, or other sibling model data present in the request payload is silently discarded and never reaches the database, eliminating the privilege escalation path."
}
],
"title": "MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection",
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "Draft vulnerability metadata was generated from a git-format patch using an Ollama-hosted language model. Human validation is required before publication.",
"gna_source": 1,
"models": [
{
"gna_source": 1,
"identifier": "qwen3.8:27b",
"name": "qwen3.8:27b",
"source": "ollama"
}
],
"review_status": "full",
"scope": "record",
"tags": [
"ai-computer-assisted:llm-generated",
"ai-computer-assisted:classification"
]
}
]
},
"bcp-05-x-02": {
"x_patch2vuln": {
"assumptions": [
"The affected version boundary is inferred from the tag_version_boundary metadata (v2.5.48 with 24 commits after fix), suggesting the fix is included in v2.5.48. No explicit version range is stated in the patch itself.",
"The privilege level required is assumed to be \u0027perm_tag_editor\u0027 based on the commit message; the exact permission model and whether other roles are affected is not fully verifiable from the patch alone.",
"CAPEC-126 (Parameter Tampering) is selected as the closest match; the attack is more precisely a mass-assignment / sibling-model injection via an ORM bulk-save, for which no exact CAPEC exists. CAPEC-126 is the best available approximation.",
"The CVSS assumes the attacker can reach the MISP web interface over the network and holds a valid session with tag editor permissions. No multi-step or race-condition requirements are evident.",
"The Co-Authored-By line references an AI assistant (Claude Opus 4.8); it is credited as a tool rather than a human remediation developer."
],
"capecRationale": [
{
"capecId": "CAPEC-126",
"rationale": "The attacker tampers with the HTTP request by injecting additional model fields (User, Organisation) into the tag collection payload. The application\u0027s bulk-save logic processes these unexpected parameters without filtering, leading to unauthorized record creation or modification. This is the closest CAPEC to the observed attack: adding extra parameters to a legitimate request to trigger unintended side effects."
},
{
"capecId": "CAPEC-1",
"rationale": "The application accepted the entire request body without validating or restricting which model keys were present before passing it to the persistence layer. This is a secondary mapping; CAPEC-126 is more specific to the parameter-injection attack vector observed here."
}
],
"commit": "96f735e7b5d9e28ea2eaf3d8a02ab800bad5c9ed",
"confidence": "high",
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Jeroen Pinoy"
},
{
"lang": "en",
"type": "remediation developer",
"value": "iglocska"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Claude Opus 4.8"
}
],
"cvssRationale": "The vulnerability is exploitable over the network (AV:N) with low complexity (AC:L) by simply adding extra fields to a legitimate tag collection request. No special attack conditions are required (AT:N). The attacker needs an authenticated account with the tag editor permission (PR:L). No user interaction is needed (UI:N). The primary impact is on integrity (VI:H) because the attacker can create or modify User and Organisation records to escalate to site admin. Modifications can be made so data can be see (VC:H) but no availability impact (VA:N). No subsequent component is affected (SC:N, SI:N, SA:N).",
"fixSummary": "The fix replaces the bulk-association save call with an explicit two-step process: first, only the TagCollection data is extracted from the request and saved via a plain save() operation that does not write belongsTo siblings; second, tag association rows are persisted individually in a controlled loop. This ensures that any User, Organisation, or other sibling model data present in the request payload is silently discarded and never reaches the database, eliminating the privilege escalation path.",
"generatedAt": "2026-09-30T09:58:24.508004Z",
"generator": "patch2vuln.py",
"model": "qwen3.8:27b",
"modelComparison": {
"rankings": [
{
"agreementScore": 9,
"assumptionCount": 5,
"confidence": "high",
"model": "qwen3.8:27b",
"score": 6
}
],
"selectedModel": "qwen3.8:27b",
"selectionMethod": "deterministic-consensus-v1",
"selectionNotice": "The selected result is closest to model consensus; this heuristic does not establish factual correctness and human review remains required."
},
"patchSha256": "67f9b5741b88384cd891423b2a8b9f5c8e071b5895b93eb337a16c7f780ee88c",
"patchSummary": "In TagCollectionsController.php, both addWithTags() and editWithTags() were modified. The full $this-\u003erequest-\u003edata is no longer passed to saveAssociated(). Instead, only the TagCollection key is extracted from the request. The saveAssociated() call is replaced with a plain save() for the collection, followed by an explicit loop that creates and saves each TagCollectionTag row individually. In editWithTags(), the tag rewrite logic is restructured to delete existing tag associations and re-insert them after the collection save. REST success/failure response handling is added to both methods.",
"patchTruncated": false,
"patches": [
{
"commit": "96f735e7b5d9e28ea2eaf3d8a02ab800bad5c9ed",
"patchSha256": "67f9b5741b88384cd891423b2a8b9f5c8e071b5895b93eb337a16c7f780ee88c",
"source": "https://github.com/MISP/MISP/commit/96f735e7b.patch",
"sourceUrl": "https://github.com/MISP/MISP/commit/96f735e7b.patch",
"subject": "fix: [security] Tag collection saves no longer write sibling"
}
],
"source": "https://github.com/MISP/MISP/commit/96f735e7b.patch",
"subject": "fix: [security] Tag collection saves no longer write sibling",
"tagVersionBoundary": {
"commits_after_fix": 24,
"repository": "https://github.com/MISP/MISP",
"tag": "v2.5.48",
"version": "2.5.48",
"version_type": "semver"
},
"weaknessRationale": [
{
"cweId": "CWE-284",
"rationale": "A user with only tag editor permissions was able to write to User and Organisation records through the bulk-association save, bypassing the intended access control boundaries. The authorization model did not restrict which associated models could be persisted."
},
{
"cweId": "CWE-862",
"rationale": "The saveAssociated() call did not enforce per-model authorization checks, allowing any associated model data in the payload to be written regardless of the caller\u0027s permissions for those models."
}
]
}
}
},
"recordType": "advisory",
"vulnId": "GCVE-1-2026-20019"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
"assignerShortName": "CIRCL",
"cveId": "CVE-2026-103239",
"datePublished": "2026-09-30T10:16:18.835Z",
"dateReserved": "2026-09-30T10:16:15.941Z",
"dateUpdated": "2026-09-30T16:50:57.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102397 (GCVE-0-2026-102397)
Vulnerability from cvelistv5 – Published: 2026-09-30 17:38 – Updated: 2026-09-30 17:59
VLAI
EPSS
VEX
Title
WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability
Summary
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 17:58 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supsystic | Ultimate Maps by Supsystic |
Affected:
n/a , ≤ 1.5.5
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102397",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T17:58:37.217050Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:59:56.305Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "ultimate-maps-by-supsystic",
"product": "Ultimate Maps by Supsystic",
"vendor": "supsystic",
"versions": [
{
"changes": [
{
"at": "1.6.1",
"status": "unaffected"
}
],
"lessThanOrEqual": "1.5.5",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Peter Tang | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unauthenticated Broken Access Control in Ultimate Maps by Supsystic \u003c= 1.5.5 versions."
}
],
"value": "Unauthenticated Broken Access Control in Ultimate Maps by Supsystic \u003c= 1.5.5 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:38:58.949Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/ultimate-maps-by-supsystic/vulnerability/wordpress-ultimate-maps-by-supsystic-plugin-1-5-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Ultimate Maps by Supsystic plugin to the latest available version (at least 1.6.1)."
}
],
"value": "Update the WordPress Ultimate Maps by Supsystic plugin to the latest available version (at least 1.6.1)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Ultimate Maps by Supsystic plugin \u003c= 1.5.5 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-102397",
"datePublished": "2026-09-30T17:38:58.949Z",
"dateReserved": "2026-09-29T00:15:56.342Z",
"dateUpdated": "2026-09-30T17:59:56.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102375 (GCVE-0-2026-102375)
Vulnerability from cvelistv5 – Published: 2026-09-30 17:39 – Updated: 2026-09-30 17:59
VLAI
EPSS
VEX
Title
WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability
Summary
Subscriber Broken Access Control in Optimole <= 4.2.14 versions.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 17:57 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://patchstack.com/database/wordpress/plugin/… | vdb-entry |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102375",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T17:57:25.365530Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:59:55.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "optimole-wp",
"product": "Optimole",
"vendor": "Optimole",
"versions": [
{
"changes": [
{
"at": "4.2.15",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.2.14",
"status": "affected",
"version": "n/a",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Dthangws | Patchstack Bug Bounty Program"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Subscriber Broken Access Control in Optimole \u003c= 4.2.14 versions."
}
],
"value": "Subscriber Broken Access Control in Optimole \u003c= 4.2.14 versions."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:39:05.158Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/wordpress/plugin/optimole-wp/vulnerability/wordpress-optimole-plugin-4-2-14-broken-access-control-vulnerability?_s_id=cve"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update the WordPress Optimole \u2013 Optimize Images | Convert WebP \u0026 AVIF | CDN \u0026 Lazy Load | Image Optimization plugin to the latest available version (at least 4.2.15)."
}
],
"value": "Update the WordPress Optimole \u2013 Optimize Images | Convert WebP \u0026 AVIF | CDN \u0026 Lazy Load | Image Optimization plugin to the latest available version (at least 4.2.15)."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WordPress Optimole plugin \u003c= 4.2.14 - Broken Access Control vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2026-102375",
"datePublished": "2026-09-30T17:39:05.158Z",
"dateReserved": "2026-09-29T00:15:56.340Z",
"dateUpdated": "2026-09-30T17:59:55.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102365 (GCVE-0-2026-102365)
Vulnerability from cvelistv5 – Published: 2026-09-28 23:34 – Updated: 2026-09-28 23:34
VLAI
EPSS
VEX
Title
mall4j through 4.0 Missing Authorization in Admin User Address Endpoints
Summary
mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/LinYuanyi1/cve-request-poc/blo… | exploit |
| https://github.com/gz-yami/mall4j | product |
| https://github.com/gz-yami/mall4j/blob/ffc672fc1a… | technical-description |
| https://www.vulncheck.com/advisories/mall4j-throu… | third-party-advisory |
Date Public
2026-09-19 00:00
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/gz-yami/mall4j",
"defaultStatus": "unaffected",
"product": "mall4j",
"repo": "https://github.com/gz-yami/mall4j",
"vendor": "gz-yami",
"versions": [
{
"lessThanOrEqual": "4.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mingsheng Lin"
}
],
"datePublic": "2026-09-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer address data. Authenticated attackers can call /user/addr/page and /user/addr/info endpoints to harvest all customer addresses including names, phone numbers, and postal information."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T23:34:29.905Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/LinYuanyi1/cve-request-poc/blob/114b3f0d149e50a7678f591bf8043399fc9ac96c/mall4j/A02_admin_useraddr_bfla.py"
},
{
"tags": [
"product"
],
"url": "https://github.com/gz-yami/mall4j"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/gz-yami/mall4j/blob/ffc672fc1aa4320ce02d0b93853bb456ae0a4dae/yami-shop-admin/src/main/java/com/yami/shop/admin/controller/UserAddrController.java#L46-L61"
},
{
"name": "VulnCheck Advisory: mall4j through 4.0 Missing Authorization in Admin User Address Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/mall4j-through-4.0-missing-authorization-in-admin-user-address-endpoints"
}
],
"title": "mall4j through 4.0 Missing Authorization in Admin User Address Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-102365",
"datePublished": "2026-09-28T23:34:29.905Z",
"dateReserved": "2026-09-28T22:50:19.577Z",
"dateUpdated": "2026-09-28T23:34:29.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102249 (GCVE-0-2026-102249)
Vulnerability from cvelistv5 – Published: 2026-09-29 03:45 – Updated: 2026-09-29 03:45
VLAI
EPSS
VEX
Title
REBUILD file-editor-save authorization
Summary
A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/411151 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/411151/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-102249 | third-party-advisory |
| https://vuldb.com/submit/933733 | third-party-advisory |
| https://github.com/ASantsSec/CVE/issues/26 | exploitissue-tracking |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:rebuild:rebuild:*:*:*:*:*:*:*:*"
],
"product": "REBUILD",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "4.4.0"
},
{
"status": "affected",
"version": "4.4.1"
},
{
"status": "affected",
"version": "4.4.2"
},
{
"status": "affected",
"version": "4.4.3"
},
{
"status": "affected",
"version": "4.4.4"
},
{
"status": "affected",
"version": "4.4.5"
},
{
"status": "affected",
"version": "4.4.6"
},
{
"status": "affected",
"version": "4.4.7"
},
{
"status": "affected",
"version": "4.4.8"
},
{
"status": "affected",
"version": "4.4.9"
},
{
"status": "affected",
"version": "4.4.10"
},
{
"status": "affected",
"version": "4.4.11"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "asants (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T03:45:12.603Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-411151 | REBUILD file-editor-save authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/411151"
},
{
"name": "VDB-411151 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/411151/cti"
},
{
"name": "CVE-2026-102249 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-102249"
},
{
"name": "Submit #933733 | REBUILD 4.4.7-release Improper Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/933733"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/ASantsSec/CVE/issues/26"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-28T21:09:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "REBUILD file-editor-save authorization",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-102249",
"datePublished": "2026-09-29T03:45:12.603Z",
"dateReserved": "2026-09-28T19:04:36.570Z",
"dateUpdated": "2026-09-29T03:45:12.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101879 (GCVE-0-2026-101879)
Vulnerability from cvelistv5 – Published: 2026-09-30 19:16 – Updated: 2026-09-30 19:16
VLAI
EPSS
VEX
Title
OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
Summary
OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot, camera.snap, and location.get over the node WebSocket to silently capture screenshots, photograph users through webcams, and obtain device geolocation without user interaction.
Severity
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/openclaw/openclaw-windows-node… | vendor-advisory |
| https://github.com/openclaw/openclaw-windows-node… | patch |
| https://github.com/openclaw/openclaw-windows-node… | patch |
| https://github.com/openclaw/openclaw-windows-node… | release-notes |
| https://github.com/openclaw/openclaw-windows-node… | technical-description |
| https://www.vulncheck.com/advisories/openclaw-win… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenClaw | OpenClaw Windows Node |
Affected:
0 , < 2026.7.1-3
(custom)
|
Date Public
2026-09-03 05:31
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenClaw Windows Node",
"repo": "https://github.com/openclaw/openclaw-windows-node",
"vendor": "OpenClaw",
"versions": [
{
"lessThan": "2026.7.1-3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Cameron Beeley (anagnorisis2peripeteia)"
}
],
"datePublic": "2026-09-03T05:31:51.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers can invoke screen.snapshot, camera.snap, and location.get over the node WebSocket to silently capture screenshots, photograph users through webcams, and obtain device geolocation without user interaction."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T19:16:01.014Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-fxch-cgcp-4v5h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openclaw/openclaw-windows-node/security/advisories/GHSA-fxch-cgcp-4v5h"
},
{
"tags": [
"patch"
],
"url": "https://github.com/openclaw/openclaw-windows-node/commit/31a8c6557df740232898079b21f0eb677a4119cf"
},
{
"tags": [
"patch"
],
"url": "https://github.com/openclaw/openclaw-windows-node/commit/16cb6897941fa7832ce2811e9d550caed9a49b4b"
},
{
"name": "OpenClaw Windows Node v2026.7.1-3 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/openclaw/openclaw-windows-node/releases/tag/v2026.7.1-3"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/openclaw/openclaw-windows-node/blob/v2026.7.1-2/src/OpenClaw.Tray.WinUI/Services/NodeService.cs#L1891-L1913"
},
{
"name": "VulnCheck Advisory: OpenClaw Windows Node before 2026.7.1-3 Missing Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openclaw-windows-node-before-2026.7.1-3-missing-authorization"
}
],
"title": "OpenClaw Windows Node before 2026.7.1-3 Missing Authorization",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-101879",
"datePublished": "2026-09-30T19:16:01.014Z",
"dateReserved": "2026-09-28T15:44:45.389Z",
"dateUpdated": "2026-09-30T19:16:01.014Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101139 (GCVE-0-2026-101139)
Vulnerability from cvelistv5 – Published: 2026-09-28 19:00 – Updated: 2026-09-29 16:30 X_Open Source
VLAI
EPSS
VEX
Title
Webkul Bagisto Invoice Mass Status Update state authorization
Summary
A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.5.0-beta5 will fix this issue. The patch is named 2c34b94d0313824ce98efee8aef8ee141d9b89d0. It is recommended to apply a patch to fix this issue. The vendor confirms: "[W]e run continuous automated AI-assisted security scanning across the Bagisto codebase. The behaviour you describe has already been identified and reproduced internally, and it is actively being fixed rather than triaged from scratch."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 19:26 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/410992 | vdb-entry |
| https://vuldb.com/vuln/410992/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-101139 | third-party-advisory |
| https://vuldb.com/submit/894633 | third-party-advisory |
| https://drive.google.com/file/d/1ymuUIZJaHZ7oDyeb… | exploit |
| https://github.com/bagisto/bagisto/pull/11493 | issue-trackingpatch |
| https://github.com/bagisto/bagisto/commit/2c34b94… | patch |
| https://github.com/bagisto/bagisto/releases/tag/v… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Webkul | Bagisto |
Affected:
2.4.0
Affected: 2.4.1 Affected: 2.4.2 Affected: 2.4.3 Affected: 2.4.4 Affected: 2.4.5 Affected: 2.4.6 Affected: 2.5.0-beta1 Affected: 2.5.0-beta2 Affected: 2.5.0-beta3 Affected: 2.5.0-beta4 Unaffected: 2.5.0-beta5 cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101139",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T19:26:03.665583Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T19:26:19.616Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*"
],
"modules": [
"Invoice Mass Status Update"
],
"product": "Bagisto",
"vendor": "Webkul",
"versions": [
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "affected",
"version": "2.4.1"
},
{
"status": "affected",
"version": "2.4.2"
},
{
"status": "affected",
"version": "2.4.3"
},
{
"status": "affected",
"version": "2.4.4"
},
{
"status": "affected",
"version": "2.4.5"
},
{
"status": "affected",
"version": "2.4.6"
},
{
"status": "affected",
"version": "2.5.0-beta1"
},
{
"status": "affected",
"version": "2.5.0-beta2"
},
{
"status": "affected",
"version": "2.5.0-beta3"
},
{
"status": "affected",
"version": "2.5.0-beta4"
},
{
"status": "unaffected",
"version": "2.5.0-beta5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ciphersecuritylabs (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.5.0-beta5 will fix this issue. The patch is named 2c34b94d0313824ce98efee8aef8ee141d9b89d0. It is recommended to apply a patch to fix this issue. The vendor confirms: \"[W]e run continuous automated AI-assisted security scanning across the Bagisto codebase. The behaviour you describe has already been identified and reproduced internally, and it is actively being fixed rather than triaged from scratch.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T16:30:39.149Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-410992 | Webkul Bagisto Invoice Mass Status Update state authorization",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/410992"
},
{
"name": "VDB-410992 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/410992/cti"
},
{
"name": "CVE-2026-101139 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-101139"
},
{
"name": "Submit #894633 | Webkul Bagisto 2.4.6 Missing Authorization",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/894633"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1ymuUIZJaHZ7oDyebyLKn9RfRPAzDKMmm/view"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/bagisto/bagisto/pull/11493"
},
{
"tags": [
"patch"
],
"url": "https://github.com/bagisto/bagisto/commit/2c34b94d0313824ce98efee8aef8ee141d9b89d0"
},
{
"tags": [
"patch"
],
"url": "https://github.com/bagisto/bagisto/releases/tag/v2.5.0-beta5"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-09-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-29T18:35:30.000Z",
"value": "VulDB entry last update"
}
],
"title": "Webkul Bagisto Invoice Mass Status Update state authorization",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-101139",
"datePublished": "2026-09-28T19:00:11.265Z",
"dateReserved": "2026-09-28T07:42:38.014Z",
"dateUpdated": "2026-09-29T16:30:39.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101063 (GCVE-0-2026-101063)
Vulnerability from cvelistv5 – Published: 2026-09-27 20:49 – Updated: 2026-09-28 13:49
VLAI
EPSS
VEX
Title
Obot before v0.23.0 Authentication Bypass via Registry API
Summary
Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 13:49 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/obot-platform/obot/security/ad… | vendor-advisory |
| https://www.vulncheck.com/advisories/obot-before-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| obot-platform | obot |
Affected:
0 , < 0.23.0
(semver)
Unaffected: 0.23.0 (semver) |
Date Public
2026-06-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101063",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T13:49:12.307977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T13:49:35.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/obot-platform/obot",
"product": "obot",
"vendor": "obot-platform",
"versions": [
{
"lessThan": "0.23.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "0.23.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "hewei-gikaku"
}
],
"datePublic": "2026-06-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Obot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled. Unauthenticated attackers can read registry metadata including server names, descriptions, repository URLs, and connect URLs by sending GET requests to /v0.1/servers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-27T20:49:54.677Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-pr6h-vr44-xq8j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/obot-platform/obot/security/advisories/GHSA-pr6h-vr44-xq8j"
},
{
"name": "VulnCheck Advisory: Obot before v0.23.0 Authentication Bypass via Registry API",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/obot-before-0.23.0-authentication-bypass-via-registry-api"
}
],
"title": "Obot before v0.23.0 Authentication Bypass via Registry API",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-101063",
"datePublished": "2026-09-27T20:49:54.677Z",
"dateReserved": "2026-09-27T16:38:56.428Z",
"dateUpdated": "2026-09-28T13:49:35.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101047 (GCVE-0-2026-101047)
Vulnerability from cvelistv5 – Published: 2026-09-27 17:02 – Updated: 2026-09-30 14:47
VLAI
EPSS
VEX
Title
Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs
Summary
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected (it returns fleet.ErrMissingLicense).
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-30 14:47 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/fleetdm/fleet/security/advisor… | vendor-advisory |
| https://www.vulncheck.com/advisories/fleet-before… | third-party-advisory |
Impacted products
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101047",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-30T14:47:09.359033Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T14:47:15.528Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/fleetdm/fleet/v4",
"product": "fleet",
"vendor": "fleetdm",
"versions": [
{
"lessThan": "4.87.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.87.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.87.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "offset"
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple\u0027s InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected (it returns fleet.ErrMissingLicense)."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-27T17:02:35.852Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q9c5-pp7m-fm2g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-q9c5-pp7m-fm2g"
},
{
"name": "VulnCheck Advisory: Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/fleet-before-4.87.0-unauthenticated-ios-app-download-via-predictable-urls"
}
],
"title": "Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-101047",
"datePublished": "2026-09-27T17:02:35.852Z",
"dateReserved": "2026-09-27T15:48:49.472Z",
"dateUpdated": "2026-09-30T14:47:15.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101000 (GCVE-0-2026-101000)
Vulnerability from cvelistv5 – Published: 2026-09-28 04:45 – Updated: 2026-09-28 04:45
VLAI
EPSS
VEX
Title
Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization
Summary
A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/410870 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/410870/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-101000 | third-party-advisory |
| https://vuldb.com/submit/919999 | third-party-advisory |
| https://github.com/senxitoyshuyi-ui/HACKALL/blob/… | exploit |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:netcore:nbr100v2:*:*:*:*:*:*:*:*"
],
"modules": [
"ACL Handler"
],
"product": "NBR100V2",
"vendor": "Netcore",
"versions": [
{
"status": "affected",
"version": "1.3.240614.030928"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "llsss (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T04:45:11.474Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-410870 | Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/410870"
},
{
"name": "VDB-410870 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/410870/cti"
},
{
"name": "CVE-2026-101000 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-101000"
},
{
"name": "Submit #919999 | Netcore\u78ca\u79d1 Router Firmware NBR100V2_V1.3.240614.030928 missing-authorization vulnerability",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/919999"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/netcore_NBR100V2_V1.3.240614.030928%20Router/netcore_nbr100v2_uci_config_tamper.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-09-27T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-09-27T12:30:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization",
"x_generator": [
"VulDB PVTS v202609"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-101000",
"datePublished": "2026-09-28T04:45:11.474Z",
"dateReserved": "2026-09-27T10:24:50.263Z",
"dateUpdated": "2026-09-28T04:45:11.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.